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Claims 1-10 (Cancelled.) 

H (New) A composed memod ** "* " * I-*""*** 

a virtual machine of a computer system, the method comprising: 
evaluating a file format of the target program; 

evaluatingcon^fleiaawitoaheaoerofamecon^^^P"^ 
automatical* configuring the virhta. machine » execute the targe, program « one of 
te e mode, of operation baaed on the file forma, and the contro. fields within the header ofthe 
£ a firs, mode of operation comprising a rea. mode, a s«ondmod. of operation for execuung 
Z programs comprising a high .eve, prog^miug » and a .bird mode of operation 

target program by the virtual machine; 

storing a sequence in which the behavior flags are set by the targe, program duttng 

execution ofthe target program by the virtual machine; 

passing behavior flag data and sequence flag data from the virtual machme to the 
computer system for evantation after execution of the target program by the vitwu machine; and 

terminating the virtual machine after execution of the target program, thereby removmg 
from the computer system a copy of the urge, program Ota, was stained within the virtual 
machine. 

12. (New) The method of Claim 11, further comprising evaluating the behavior flag data with 
the computer system. 

13 (New) The method of Claim 11. further compr^ing imtializing me virtual machme with^ 
the computer system, the virtual machine comprising a virtual computer implemented by 
software simulating functionality of a central processing unit and memory and a virtual operatmg 
system simulating functionality of an operating system ofthe computer system. 
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14 (New) Them^ofaalmU.Whcrcompn^id^a.ypeofopera.u.g^ 
inten d e dfor,h= M gc.pr 0 gra».ta«-to be executed bytevir.ua! maehto.. 

15 (New) The method of Claim U. fcrther comprising initializing the virtua. machine by 
constructing the virtual machine out of a number of layered sheik, 

,6. (New) The memod of Cairn 11, ftumer combing configuring the shells based upon a 
format of the target program. 

"17. (New) The method ofClaim 11, wherein me virtual n^hine executes the target program 
starting at each entry point defined within an entry point table. 

„ (New) Tnememod of Claim U,*^^^^ 

virtual machine operates in the first and third modes of operation. 

19 . (New) Tl* method of Qaim 11,^ 

virtual machine operates in the second mode of operation. 
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^ „ c tpm for discovering malicious code in a target program, comprising: 
20. (New) A computer system for discovering m«m 

a processing unit; 

a memory storage device; and 

Z or Lre program mod.es ^ in said memory storage devtce * P-dtng 
insmictions to said processing unit; 

said proofs unit executing said ^ of said on. or more program modules, 

operable for 

evaluating a file format of the target program; 

somatically configuring a virtual machine to execute the target program in one 
of thre* modes of operation based on me file format and the control fields within the header of 
*. file, a first mode of operation comprising a real mode, a second mode 
executing target programs comprising a high level programming language, and third mode of 
operation for executing target programs comprising thirty-two fat code; 

storing behavior flags representing behavior of the target program during 
execution of the target program by the virtual machine; 

storing a sequence in which the behavior flags are set by the target program 

during execution of the target program by the virtual machine; 

passing behavior flag data and sequence flag data from the virtual machine to the 

center system after exe^^ 

evaluating the behavior flag data and sequence flag data with the computer 

system. 

21 (New) The system of Claim 20, wherein the processing unit is further operable for 
tenoning the virtual machine after execution of the target program, thereby removing from the 
computer system a copy of the target program that was contain* within the virtuai machtne. 

22 (New) The system of Claim 20, whereto the virtual machine comprises a virtual computer 
tamiemented by the on. or more progmms simulating functionality of a central processing urn. 
and memory and a virtual opemung sysUo, simulating functionality of an operating system of 

the computer system. 
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23 (New) The system of Cairn 20, wherein the ^ .«* * ^ 

the virtual machine, 

24 (New) The system of Claim 20. whe-in the ^ - <• «her <>P«* * 
single virtual — * — „g * virtual machine on, of a — of layered 

shells. 

25. (New) The system of Claim 24, wherein the processing unit is fcrmer op*r*le for 
conSgwing the shells based upon a format of the target program. 

26. (New) The system of Claim 20. wherein the virtual machine execute, the ttrge. program 
starting at each entry point defined within an entry point table. 

27 (New) T»^«C^*^*P»^^*^'^* k ** m \ 

software CPU shell when the virtual machine operates in the first and second modes of 

operation. 

28 (New) The system of Claim 20^ 

lang uage interpreter when the virtual machine operates in the second mode of opcrat.cn. 
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29 . (New) A compufer-inmlemcnted method for -dentifying «* * ' *»* 

modes of operate, a firs, mode of operation comprising a real mode, a second mode of 
Tp^ol for executing a Urge, program coding a high level proving » - 
ILode of aeration comprismg a proved mode for — g a Urge, program compnsmg 

rtj o^vior flag, represent behavior of the urge, program during execution of me 

tareet program by the virtual machine; 

storing a science In which ft. behavior flags are se, by me urge, program dunng 
executtonoftherargelprogrambymevirroalmachme; 

passing behavior flag da* and sequence flag da* from me vulual nuci^e ,0 a computer 
8 v«emafterexecunonofme,arge,pro r ambym«virmalmachme ; and 

terminating ft. virtual machine after execution of ft. ,arge, program, .hereby removmg 
from me computer system a copy of me urge, program ma, was conUined vvtthin the vutua. 
machine. 

30. (New, Thecomput^-taplementeomemodof^^ 
format of the target program. 
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